Flare

This connector integrates Flare (https://flare.io) — a cyber threat intelligence platform monitoring dark web, leak sites, threat actor forums, and other external sources — with OpenCTI. It periodically fetches new security events from the Flare API and converts them into STIX2 incidents with related observables. Supported event types include leaked credentials (emails, usernames), stealer logs from infected devices (with associated malware family), lookalike/typosquatting domains, and ransomware leak publications. Each event is imported as a STIX Incident linked to its relevant observables (EmailAddress, UserAccount, IPv4Address, DomainName, URL) via related-to relationships.